Resources Required for Topological Quantum Factoring 
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We consider a hypothetical topological quantum computer where the qubits are comprised of 
either Ising or Fibonacci anyons. For each case, we calculate the time and number of qubits (space) 
necessary to execute the most computationally expensive step of Shor's algorithm, modular expo- 
nentiation. For Ising anyons, we apply Bravyi's distillation method [S. Bravyi, Phys. Rev. A 73, 
042313 (2006)] which combines topological and non-topological operations to allow for universal 
quantum computation. With reasonable restrictions on the physical parameters we find that fac- 
toring a 128 bit number requires approximately 10^ Fibonacci anyons versus at least 3 x 10® Ising 
anyons. Other distillation algorithms could reduce the resources for Ising anyons substantially. 



Shor's algorithm is at the center of much of the excite- 
ment surrounding quantum computation. Classically, the 
time to factor a number of length C grows exponentially 
in C, but given a sufficiently large quantum computer, 
Shor's algorithm could be used to factor in polynomial 
time [1]. Specifically, the most computationally expen- 
sive step of Shor's algorithm is modular exponentiation 
which scales as . Since internet security is based on the 
near impossibility of factoring large numbers, the ability 
to factor in polynomial time, or in other words, the ex- 
istence of a sufficiently large quantum computer, would 
be of monumental importance. In this letter, we will ad- 
dress the question of what sufficiently large means for a 
topological quantum computer. 

Many different systems have been proposed as the 
building blocks for a quantum computer known as quan- 
tum bits or qubits, but we will focus on topologically pro- 
tected qubits which are created using non-Abelian par- 
ticles [2]. Topological systems are particularly attractive 
candidates for quantum computation because of their 
natural resistance to decohercnce. Non-Abelian particles 
have the property that topological operations, or braid- 
ing the particles around each other at large distances, can 
rotate the system between its degenerate ground states. 
The ground state degeneracy grows exponentially with 
the number of particles allowing groups of particles to 
store quantum information in the form of qubits [H [3] . 

The most commonly considered non-Abelian particle 
is the Majorana fermion, or Ising anyon, where it is 
most convenient to use four Ising anyons to form a sin- 
gle qubit. Ising anyons are expected to be the exci- 
tations of the V = h/2 fractional quantum Hall state 
[4]. Additionally, there have been proposals to create 
Ising anyons in Sr2Ru04 thin films [5 , cold atoms [6], 
and most recently in several varieties of strongly coupled 
spin orbit systems involving superconducting junctions 
[7]. While Ising anyons are the simplest example of a 
non-Abelian particle, braiding Ising anyons is not suffi- 
cient for universal quantum computation (UQC). Bravyi 
has suggested a method for combining topological and 
non-topological operations to allow for UQC with Ising 



anyons [5]. We will explore this method in detail below, 
but the basic strategy is to create entangled states using 
non-topological operations and then braid these states 
with the target qubits to perform gates that are not al- 
lowed topologically. We find that when the time to pre- 
pare these entangled states is large compared to the time 
to run the algorithm, the number of qubits required to 
perform the algorithm scales approximately as the num- 
ber of gates, N, which is proportional to . 

A second type of non-Abelian particle are Fibonacci 
anyons which are expected to be the excitations of the 
V = fractional quantum Hall state [S] and exist in 
certain toy lattice models [TU]- Here it is convenient to 
use three Fibonacci anyons to form a single qubit. Since 
braiding Fibonacci anyons is sufficient for UQC, the num- 
ber of Fibonacci anyons needed to factor a number of 
length C scales as C rather than . Practically, this 
means that factoring a 128 bit number requires approx- 
imately 10^ Fibonacci anyons rather than 3 x 10^ Ising 
anyons. While 10^ is a huge number, Ising anyons re- 
main attractive as a possible platform for quantum com- 
putation because, as shown by Bravyi [5], and seen ex- 
plicitely below, there is a high error tolerance for the non- 
topological operations necessary to prepare the states. 

To estimate the number of particles necessary for mod- 
ular exponentiation, we will assume that all braid opera- 
tions can be performed perfectly and that error only re- 
sults from the error intrinsic in the gates themselves. For 
Ising anyons, the error stems from the non-topological 
operations needed to prepare the entangled states, while 
for Fibonacci anyons, the length of the braid determines 
the accuracy of the gate. In this paper, all errors will 
be stated as error probabilities (the square of the am- 
plitude), and for both Ising and Fibonacci anyons, the 
error per gate must be less than or on the order of l/M 
where N is the total number of gates |TT| . Additionally, 
we assume that the state of the qubit can be measured 
efficiently and with negligible error (which can always 
be achieved by repetitive measurements). The number 
of NOT, CNOT, and CCNOT gates required for efficient 
modular exponentiation is proportional to and was 
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calculated precisely in Ref. T^. For C ~ 128, the total 
number of gates is A/" ~ 10^. 

Ising Anyons: Bravyi's method to achieve UQC 
with Ising anyons uses non-topological operations to 
poorly approximate the one and two qubit states [04) = 
^(|0)+e-/4|l)) and jag) = ^ (|0, 0) + |1, 1)). These 
states are then distilled in a process that takes many 
states with large error to a single state with smaller er- 
ror using only topological operations and measurements 
[13] . States with arbitrarily small error can be pro- 
duced by repeating the distillation process. The puri- 
fied |a4) and jag) states are then braided with the tar- 
get qubits to implement the controlled 7r/4 phase gate, 
A(e'''/''), and CNOT gates. The combination of CNOT 
and A(e"^/'^) allows for UQC with Ising anyons |13) . 

We will calculate how many qubits and how many op- 
erations are necessary to first distill the states and then 
execute the modular exponentiation algorithm. Ref. [S] 
carried out a similar calculation and found that to distill 
N states, the number of operations and qubits neces- 
sary scaled as A^(ln7V)"^. This calculation assumed that 
the error in the initial states was asymptotically small, 
and in this limit, the distillation procedure is successful 
nearly 100% of the time. Since the probability of a suc- 
cessful distillation vanishes as the initial error approaches 
an upper bound, the number of qubits required to distill 
one state depends strongly on the initial error. Addition- 
ally, the calculation did not account for the possibility of 
reusing qubits or performing distillation rounds in par- 
allel. In theory, one could imagine starting with enough 
qubits to distill all M states simultaneously without qubit 
reuse and then performing the modular exponentiation. 
This would minimize the time; however, as we will see, 
it would also require a gigantic number of qubits. In our 
calculation, we will not assume asymptotically small ini- 
tial error and we will explore the balance between the 
time and space requirements by combining parallel op- 
erations with reusing qubits. Initially, since N distilled 
states are required to perform the algorithm, let us as- 
sume we have at least M qubits to work with (which is 
already a large number) and we will attempt to perform 
the full distillation and algorithm with no more than this 
number (we will further examine this requirement below) . 

The number of qubits necessary to distill a single jag) 
state is shown in Fig.jlja) where jag) distillation is only 
successful when the initial error is less than 0.38. Notice 
that even for a relatively large initial error, the number 
of qubits to distill one |ag) state is small compared to 
N for C = 128. Given our attempt to limit the number 
of qubits, we choose to create N |ag) states using 0{N) 
qubits. Specifically, we will start with about M poorly 
approximated |ag) states and perform the distillation al- 
gorithm in parallel on all these initial states. This will 
result in a small fraction of the initial qubits being con- 
verted into fully distilled |ag) states. The remainder of 
the qubits can be reinitialized to poor approximations of 



|ag) and again distilled in parallel to purified |ag) states. 
By repeating this process, nearly all the initial qubits can 
be converted into fully distilled |ag) states. Note that the 
distillation process ends by measuring the qubits which 
are not part of the distilled state. Since these qubits 
are no longer entangled with the purified state, they can 
easily be reused in a subsequent distillation. 

[04) distillation has an added complication because |ag) 
states are required in the distillation process. At each 
level of distillation, the |ag) states must have an error 
at least as small as the final [04) states. The number of 
qubits to distill a single [04) state is shown in Fig. [T]^b), 
where the qubits needed for the [04) and |ag) states are 
plotted separately, and the maximum error for the initial 
1 04) state is 0.14. Notice the number of qubits needed 
for |ag) states sometimes decreases as the initial error in- 
creases. These decreases result from a technicality where 
less exact |ag) states are required within the |a4) distil- 
lation round. To avoid confusion, we will not plot these 
nonmonotonicities in the future as the distillation can 
always be run assuming the larger error. 

To distill many [04) states, we will again choose to min- 
imize the space requirements and use only 0{N) qubits 
to distill M 1 04) states. Since the number of qubits 
needed to make |ag) states for a single |a4) distillation (we 
will call these states jog^'')) approaches A/" for £ = 128, 
our distillation scheme will be to dedicate approximately 
A/" qubits to making \a"^^) states. We will then make as 
many \a'^^) states as possible, do the |a4) distillation, go 
back and reuse the qubits to make more |ag^'') states, do 
another round of |a4) distillation and repeat this process 
until the [04) states are fully distilled. |a4) distillation is 
slow compared to |ag) distillation, so when considering 
the total resources required, there will be a one to one 
trade-off between space and time that depends on the 
number of qubits dedicated to jag^-*) production. 

The results for how many qubits and how much time 
is required to perform modular exponentiation with Ising 
anyons are shown in Fig. [2] We define the time to per- 
form one braid as a time step, and our calculations as- 
sume that a measurement can also be performed in a 
single time step. This assumption is probably unrealis- 
tic, but currently no model exists for estimating the time 
of a measurement. Measurements account for between 5 
and 8% of the operations while running the distillation 
and executing the CNOT and CCNOT gates with the re- 
mainder being topological braids. If the time to perform 
a measurement is an order of magnitude longer than to 
perform a braid, then the total time will nearly double 
from that plotted in Fig. [2] (this may be the case if repet- 
itive measurement is required to obtain reliability). 

Fig. [2] can be considered in three regimes which are 
sketched in Fig. [3j When the initial error is small enough, 
tdist, the time to distill all the required |ag) and [04) 
states as outlined above, is short compared to the time 
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FIG. 1: (color online) Plot (a) shows the number of qubits 
required to create a single |ag) state with final error of 10~^ 
(dashed), 10~" (sohd), and 10"^^ (dash-dot). The jumps 
indicate where the number of distillation levels increases by 
one, with plateau at 0.1 being four purification rounds. Plot 
(b) shows the number of qubits to create a single |a4) state 
where (i)/(ii) is the qubits to make |a4)/|ag) states. The 
initial error of the lag) states is taken to be 0.01, and the final 
errors for |a4) are the same as plot (a). 

to run the algorithm, taig. Rather than distilling the 
states all at once, we will minimize the number of qubits 
subject to the constraint that the total distillation time 
is comparable to taig- In this model, states are distilled, 
used to perform the algorithm, and then the qubits are 
reused to distill more states and continue the algorithm, 
and so on until the algorithm is completed. For any given 
C, there always exists an initial error small enough such 
that the time to run the algorithm dominates, so state 
distillation does not need to change the scaling of the 
total time. In Figs. [2] and [Sj this regime is seen where the 
time is nearly flat and the number of qubits is increasing. 

For larger values of the initial error, tdist becomes large 
compared to taig, and we choose to use 0{N) qubits to 
distill all the states at once as described previously. In 
this case, the time does not depend directly on £, but 
rather on the number of distillation rounds necessary to 
fully purify the [04) and jag) states. Hence, the time 
is nearly independent of £ across a wide range of values 
and increases as the initial error increases. We choose the 
total number of qubits to scale as A/", but there is approx- 
imately a one to one trade off between space and time. 
Conceivably, the number of qubits could be significantly 
reduced, but the total time would increase comparably. 
Additionally, for any initial error, there is always an C 
large enough to return us to the previous region where 

Finally, as the initial error approaches its upper bound, 
the number of qubits to distill a single state becomes 
comparable and eventually exceeds Af. Once this hap- 
pens, both the total number of qubits and total distilla- 
tion time diverge. Note that the time does not exhibit a 
strong divergence in Fig. [2] as the initial error of the [04) 
states is increased because the initial jag) error remains 
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FIG. 2: (color online) Total qubits and time steps necessary 
for modular exponentiation. The connected (dashed) lines are 
for changing the initial error of the lag) (|a4)) states while the 
|a4) (jag)) initial error is held constant at 0.01. 
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FIG. 3: (color online) Cartoon sketch to help clarify Fig. [2] 
The three regimes which describe our results are when the 
time to run the algorithm, tatg, is (a) greater than tdist, (b) 
less than tdist, and (c) when the number of qubits to distill 
a single state is comparable or large compared to A/". These 
three regimes are seen in Fig. [2] for £ = 512 while changing 
the initial error of |ag) (solid line) for the approximate values 
(a) 0-0.07, (b) 0.07-0.35, and (c) 0.35-0.38 (not shown). 

small. The details of Fig. [2] depend on the exact distilla- 
tion scheme, but the qualitative results sketched in Fig. [3] 
are more universal. 

Using the results from Ref. [T5] and the distillation 
scheme in Fig. [2] we can estimate the size of a i/ = 5/2 
sample and the total time necessary to perform modu- 
lar exponentiation when C = 128. For approximately 
10^ gates, each gate must have error < 10~^. Taking 
the initial |a4) and lag) error to be 0.01, we need ap- 
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proximately 10^^ time steps and 3 x 10^ quasiparticles 
(qp's) to create all the states and perform the algorithm 
(see Fig. [2]). To manipulate the qp's, we apply an elec- 
tric field with magnitude much less than ^ A/(e*^*) to 
avoid particle-hole pair creation where A is the gap of 
the 5/2 state, e* = e/4 is the qp charge and i* — 2£ 
is the effective magnetic length. This results in a maxi- 
mum Ex B drift velocity of order Ai/h. Using the decay 
length from Ref. (TS], and assuming A = IK, we find that 
the qp's need to be separated by at least 100£ and that 
the maximum step rate is 30 MHz. Modern single elec- 
tron pumps can function at a rate of nearly 20 MHz with 
error rates as low as 15 per 10^ [16], so achieving 30 MHz 
with comparably low error seems plausible. At this step 
rate, the calculation would take approximately 3 x lO'^s 
on a sample that is at least 10cm x 10cm. While we can 
trade some amount of space for time, if one were to re- 
duce the space by more than a few orders of magnitude, 
the runtime would become sufficiently long that classical 
computers could potentially compete. Parameters will 
differ and may be more favorable for other potential sys- 
tems of Ising anyons [S'-'T^ . 

Fibonacci Anyons: Computation with Fibonacci 
anyons is in many ways much simpler than using Ising 
anyons. Since braiding Fibonacci anyons is sufficient for 
UQC, we only need to find a braid to implement the 
desired gate. Additional entangled states to act on the 
target qubits are not necessary, so the space needed to 
perform modular exponentiation will be 0{C), the length 
of the number to factor. Further, only 0{£) measure- 
ments are required at the end of the calculation. How- 
ever, Fibonacci anyons do not naturally implement NOT, 
CNOT, or CCNOT gates [T7], so the challenge is to find 
a braid which approximates the desired gate to the nec- 
essary level of accuracy. 

Brute force searches for braids have found that gate 
error becomes exponentially small as the braid length 
is increased linearly [18, : however due to computational 
difficulty, the longest brute force braid available is about 
80 steps with an error of about 10"^". The accuracy 
of any braid can be improved using the Solovay-Kitaev 
(SK) algorithm [T3]. With each iteration of SK, the error 
improves as ei cEq^^ and the braid length increases by 
a factor of 5. Therefore, we can again construct gates 
with arbitrarily small error, but at the expense of the 
braid length growing as 5", where n is the number of SK 
iterations. (Other schemes to obtain longer and more 
accurate braids may replace or be combined with SK be- 
yond where brute force searches are feasible [H].) 

Fig. [4] shows the time to complete modular exponen- 
tiation using Fibonacci anyons as a function of C. The 
total space scales as C and is 2£ -I- 3 for this specific 
implementation of modular exponentiation jl2[ . For 
C = 128, modular exponentiation requires 259 qubits 
(777 Fibonacci anyons). The time will be proportional 
to the braid length per gate times the number of gates. 
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FIG. 4: Number of time steps needed to complete modular 
exponentiation with Fibonacci anyons. Each jump is where 
an additional SK iteration is required, and for jC < 500, the 
braid is determined solely by the brute force search method. 

which is approximately 10^^ time steps. Assuming a com- 
prable minimum distance between qp's in the v = 12/5 
state as the 5/2 state, the gap in the 12/5 state restricts 
the maximum step rate to about 3 MHz, so this compu- 
tation would take on the order of 3 x 10^ seconds. 

To summarize, we explore the space and time require- 
ments of Bravyi's distillation technique for Ising anyons. 
We find a good balance by producing Af nontopological 
gates using 0{N) qubits. For this to succeed, the initial 
error in the \ai} and jag) states must be small enough 
such that the number of qubits needed to distill a sin- 
gle jag) or 1 04) state is small compared to M . When the 
time to run the algorithm is small compared to the time 
to distill states, we can reduce the space even further by 
distilling the states in batches while running the algo- 
rithm. We note that we have made certain assumptions 
concerning the trade-offs between space and time which 
we believe are appropriate and would give the best possi- 
ble outcome in a realistic system. However, other choices 
can be made, and the results can be worked out from the 
details we provide. 

Note Added: Since the completion of this work we have 
learned of an unpublished method that allows for CNOT 
without |ag) distillation [20 . Analysis of this new algo- 
rithm is beyond the scope of the current work, but rough 
estimates suggest that this new scheme could reduce tdist 
by a factor of ~ lO'^ compared to the example presented 
here. 
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by US DOE Grant No. DE-FG02-97ER45639. 
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